Published 15 September 2026
Ant Group published 27 new SingProbe checkpoints on 14 September 2026, bringing its token-level safety guardrail to 29 open-weight models including DeepSeek, Qwen, GLM, Llama, gemma-4 and OpenAI’s gpt-oss. Each probe is between 2.23 and 12.06 million parameters, roughly a thousandth the size of the 8 billion parameter guard models it is measured against, and Ant reports it adds under 0.5% to decoding time. The catch is that Ant’s own model card says the serving code still only runs on its Ling-3.0 models.
What does SingProbe do?
Most safety filters are a second model. You generate an answer, then send it to a separate guard model that reads it and decides whether it is safe. That costs a full extra inference pass, and the verdict only arrives once the answer is finished.
SingProbe works differently. It attaches to three layers inside the model you are already running and reads the hidden states, the intermediate numbers a model produces as it writes. For every token it outputs ten scores: seven risk categories for the user’s request, one for a safe request, one for whether the answer so far is unsafe, and one for whether the model is making things up.
Because the base model has already done the heavy lifting, the probe adds almost nothing. Ant measured between 0.18% and 0.45% extra time per token on Ling-3.0-flash. The practical payoff is that you can stop an unsafe answer while it is being written, rather than blocking it after the fact.
- Family size: 29 checkpoints, 27 of them published on 14 September 2026
- Probe size: 2.23 million parameters on Qwen3-0.6B, up to 12.06 million on GLM-5.3
- Newly covered base models include DeepSeek-V4-Flash-0731, GLM-5.2, GLM-5.3, gpt-oss-20b, gpt-oss-120b, three gemma-4 sizes, Llama-3.1-8B, MiniMax-M2.7, Step-3.7-Flash, Tencent Hy3 and eleven Qwen variants up to Qwen3.5-397B-A17B
- Licence: each probe inherits the licence of the model it attaches to, so Apache 2.0 for the Qwen and gemma-4 probes and MIT for the DeepSeek one
- Training code: on GitHub, with no licence file at all
- Technical report: arXiv:2608.30703, published 31 August 2026 under CC BY 4.0
SingProbe benchmarks against Qwen3Guard and Llama Guard
The point of the table below is not that a 12 million parameter probe wins outright. It is that it does not clearly lose to guard models several hundred times its size.
| What is measured | SingProbe, best of the 29 | The standalone alternative |
|---|---|---|
| Spotting a harmful request (F1) | 0.8811 on DeepSeek-V4-Flash-0731 | 0.8714, YuFeng-XGuard-Reason-8B |
| Spotting a harmful answer (F1) | 0.8729 on Qwen3.5-27B | 0.8604, Qwen3Guard-Gen-8B-strict |
| Catching it mid-answer (R-AUC) | 0.9905 on Qwen3.5-397B-A17B | 0.9640, Qwen3Guard-Stream-8B-strict |
| Spotting a made-up fact (AUC) | 0.8170 on GLM-5.3 | 0.8000, the DRIFT probe method |
| Size of the guard | 2.23M to 12.06M parameters | 7.57B, Qwen3Guard-Stream-8B |
| Extra decoding time | under 0.5% | one more full model pass |
Every figure here is Ant’s own, taken from the individual model cards. Ant’s technical report explains the method but evaluates only two of the 29 checkpoints, so the numbers for the other 27 have no published methodology behind them. Ant also states that some competitor scores were reused from its earlier SingGuard paper rather than re-run. The hallucination result is the thinnest of the four: 0.8170 against 0.8000, with no error bars and no significance test.
What Ant Group is not saying
The biggest gap is that most of these probes have nothing to run on. The Ling-3.0-flash model card states plainly that the SGLang and vLLM integrations currently support Ling-3.0 base models only. The 27 cards published on 14 September leave that sentence out and print a launch command anyway. Unless you serve Ling-3.0, the checkpoint you download today has no working runtime.
Both integrations are personal forks by one of the paper’s authors, not branches of upstream SGLang or vLLM, and neither has been merged. The training code was last pushed on 3 September, eleven days before the 27 checkpoints appeared, so it was never updated for them. It ships with no licence.
Two numbers are quieter than they look. The 0.03% false alarm rate on ordinary answers is printed identically in all 29 cards, so it is one measurement on Ling-3.0-flash reproduced 28 times. And the cards report false alarms on answers but not on questions, where Ant’s own paper puts SingProbe at 0.13% against 0.06% for Llama Guard 3. That comparison is itself out of date: Llama Guard 4 has been available since April 2025 and does not appear in the paper.
What this means
Test this now if you serve Ling-3.0 yourself and currently pay for a second guard model alongside it. That is a narrow group, but for them the arithmetic is unusually clean. You swap an 8 billion parameter model for a 5 million parameter probe, keep roughly the same accuracy on Ant’s numbers, and get a verdict per token instead of per answer. For a small team running an internal assistant on its own hardware, this is the first guardrail in a while that does not effectively double the inference bill.
Everyone else should watch rather than download. The 27 new checkpoints are a statement of intent, not a product: without an upstream runtime they are 27 files you cannot serve. The thing to watch for is a merged pull request in SGLang or vLLM. If that lands, a guardrail costing half a percent of decoding time is genuinely interesting, and the fact that Ant trained probes for its competitors’ models suggests it wants this to become the default way open models police themselves. If it does not land, this stays a paper with 29 attachments.
For more information, visit the official announcement of SingProbe in the SingProbe model card.
